Over the last few days I've gotten a lot of spam spoofing my address
of [log in to unmask] as both sender and receiver. When I wrote
[log in to unmask] they advised me to block the sender. While I could do
that, for the naive eye, the sender is a faux me, and for the more
sophisticated eye, the sender varies.
Here is the latest spam mail, including headers, showing that various
@msu.edu mailboxes are targets. Maybe ATS could investigate and block
this.
/rich
Delivered-To: [log in to unmask]
Received: by 10.220.150.66 with SMTP id x2cs100855vcv;
Sat, 17 Sep 2011 02:54:07 -0700 (PDT)
Received: by 10.101.199.1 with SMTP id b1mr322199anq.113.1316253246653;
Sat, 17 Sep 2011 02:54:06 -0700 (PDT)
Return-Path: <[log in to unmask]>
Received: from mx50.mail.msu.edu (mx50.mail.msu.edu [35.9.75.200])
by mx.google.com with ESMTPS id q20si7319259ann.202.2011.09.17.02.54.05
(version=TLSv1/SSLv3 cipher=OTHER);
Sat, 17 Sep 2011 02:54:05 -0700 (PDT)
Received-SPF: neutral (google.com: 35.9.75.200 is neither permitted
nor denied by best guess record for domain of [log in to unmask])
client-ip=35.9.75.200;
Authentication-Results: mx.google.com; spf=neutral (google.com:
35.9.75.200 is neither permitted nor denied by best guess record for
domain of [log in to unmask]) [log in to unmask]; dkim=pass
[log in to unmask]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=msu.edu; s=mail;
h=Subject:Content-Transfer-Encoding:Message-ID:Content-Type:MIME-Version:Date:Subject:To:From;
bh=PPHK/Wp7KaXpYd/lArfkx4/wCaK+c9q7uYlkDGfsAls=;
b=PyByD4v7moLaK3up8gthlqFqDTy/KILfGbhldZR7oNVTRkpL6yR0L3O0MfUYDo8eqVBdehOIqhzSjbFYDpasXiikp9jzHmEbYCFOEQUFXrGWbE4AyOtqxxKyfKUql1C6RRYXr4bGG8JaODfrGYvmYTTDkQZGtH55DJMu7mZ+QdA=;
Received: from [31.162.119.179]
by mx50.mail.msu.edu with esmtp (Exim 4.75 #3)
id 1R4rb1-0003Ql-J8; Sat, 17 Sep 2011 05:54:04 -0400
Received: from 31.162.119.179(helo=fkdafof.affywvodwzspl.su)
by with esmtpa (Exim 4.69)
(envelope-from )
id 1MMYGQ-2440yd-8T
for [log in to unmask]; Sat, 17 Sep 2011 14:54:02 +0500
From: <[log in to unmask]>,
<[log in to unmask]>,
<[log in to unmask]>
To: <[log in to unmask]>,
<[log in to unmask]>,
<[log in to unmask]>
Subject: FW: Update your PC
Date: Sat, 17 Sep 2011 14:54:02 +0500
MIME-Version: 1.0
Content-Type: text/html
charset="iso-8859-1"
X-Priority: 3
X-Mailer: dztg-77
Message-ID: <[log in to unmask]>
Content-Transfer-Encoding: quoted-printable
X-Virus: None found by Clam AV
X-Spam-Level: ******
X-Spam-Report: All incoming messages to mail.msu.edu are analyzed for
typical spam
characteristics. See http://techbase.msu.edu/article.asp?id=11475 for
additional report information.
Content preview: Best online (pirated) software: 92.63.81.93,Good Luck [...]
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[31.162.119.179 listed in zen.spamhaus.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[31.162.119.179 listed in bb.barracudacentral.org]
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
X-Spam-Score: 6.3
Subject: *****SPAM***** FW: Update your PC
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
